move on_successful_authorization to before_successful_authorization and after_successful_authorization